Privacy notice
Last updated 24 October 2026
The short version
- Who we are
- FortiGuardian Consulting Ltd, trading as Hven, a UK company.
- What we collect
- Your account, the businesses you add, and our check results.
- Why
- To run Hven, keep it secure, and email you about it.
- Who we share with
- AI companies we ask, and services that host Hven and send its email. We never sell your data.
- Your rights
- Get a copy, or have your data corrected or deleted.
- Contact
- info@hven.io. A person reads every message.
1. Who we are
Hven is run by FortiGuardian Consulting Ltd, trading as Hven. Registered in Northern Ireland, company number NI744497, registered office 32 Wellesley Avenue, Belfast, Northern Ireland, BT9 6DG.
We are the "controller" of the personal data in this notice: we decide how and why it is used. The exception is data an agency gives us about its clients, which we handle for the agency (section 2).
Contact us by email at info@hven.io.
Hven checks how AI assistants talk about businesses. We do not ask for or collect special-category data, such as health, ethnicity, religion, political opinions or sexual orientation. Text you write to us, or text on a website we read, could contain it, so please leave it out.
2. Who this notice is about
- People with a Hven account, and team members invited to one.
- People connected to the businesses our customers add. An agency can add its clients' businesses. For that client data we act for the agency, as its "processor": the agency is the controller, and our terms bind us to use the data only to provide Hven to the agency.
- People at businesses we look at from public sources, such as businesses named in AI answers, or businesses an Agency customer analyses (section 3.4).
- People we contact about Hven (section 3.5).
- Visitors who use the free tools on our website without an account.
If we hold data about you that you did not give us yourself (sections 3.3 to 3.5), this notice is how we tell you about it.
3. What we collect
3.1 From you, when you have an account
- Your account: name, email address, and your password, which we store only in a scrambled form (a one-way hash) that cannot be turned back into the password.
- If you sign in with Google: Google gives us your name and email address. We do not keep your Google picture, your Google ID or any Google password or token.
- Your workspace: its name, and the team members you invite.
- Your settings: email preferences, theme, and similar choices.
- If you ask for early access to Data Studio: the Google email address you give us, so we can add it to our Google project's list of people allowed to connect.
- Things you send us: feedback, survey answers and emails.
3.2 Created when you use Hven
- A security log of important actions on your account, such as inviting a team member, changing your password or creating a key. Each entry records the IP address and browser type used. We do not log ordinary sign-ins in this log.
- Which main pages of the app you open, and when. This does not include your IP address.
- Copies of the emails we send you, including their full text.
3.3 About the businesses you add
- Brand name, website, country, city, social media handles, the competitors you track, and a description of the business: what it sells, who its customers are, and what kind of business it is.
- A profile we build by reading the business's homepage.
- The questions we ask AI assistants for that business, their answers, and the scores, citations, rivals and recommendations we work out from them.
Most of this is about businesses, not people. It becomes personal data when the business is a person, such as a sole trader whose brand is their own name.
3.4 Pitch audits (Agency plan only)
Agency customers can analyse another business's visibility in AI answers ("pitch audits"). For this we hold the business's website, name and, if found through Google search, its business address. We do not store contact names or email addresses for these businesses. Hven can draft an email the customer may send; the customer sends it themselves from their own email account. Hven never sends it.
3.5 People we contact about Hven
We sometimes contact businesses about Hven. We only use an email address the business has published itself as a link on its own website, an address that wrote to us, or one given to us directly. We never guess or buy addresses. We keep the business name, the contact's name and role where published, the address, where we found it, and the emails we draft. To stop hearing from us, reply and say so.
3.6 Visitors to our free tools
- Free website tools (such as the llms.txt generator): the website address you enter, your email address if you give it to receive a result, and the IP address you used. We keep the IP address to stop abuse.
- Website scan on our homepage: the website address you enter and, if you give it, your email address.
4. Why we use your data, and our lawful basis
| What we do | Data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Run your account and the checks you ask for | 3.1, 3.3 | Contract (Art 6(1)(b)) |
| Send account emails (verification, password reset, invites, data-export links) | Email address | Contract (Art 6(1)(b)) |
| Add you to Data Studio early access, and tell you when you're in | The Google email address you gave us (we type it into Google's list); your Hven email address (for the "you're in" email) | Contract (Art 6(1)(b)): a step you asked us to take |
| Send your weekly or monthly report | Email address, results | Contract (Art 6(1)(b)). It is part of the service you signed up for. You can turn reports off in Settings. |
| Send welcome, founder-note and occasional product-news emails | Name, email, workspace details | Legitimate interests: telling customers about the product they use. You can turn product news off in Settings. |
| Keep the security log | 3.2 security log | Legitimate interests: protecting accounts and investigating misuse |
| Count which app pages are used | 3.2 page views | Legitimate interests: improving the product |
| Stop abuse of sign-up and the free tools (IP limits, bot checks, blocking throwaway email addresses) | IP address, email address | Legitimate interests: keeping the service available and secure |
| Tell the founder when someone signs up or finishes setting up | Email, workspace name, chosen plan, brand and website | Legitimate interests: running our small business |
| Pitch audits for Agency customers (3.4) | 3.4 | Legitimate interests: of our customer, in understanding businesses' public visibility |
| Contacting businesses about Hven (3.5) | 3.5 | Legitimate interests: telling businesses about a relevant product |
| Send you the free result you asked for (3.6) | Email address, website | Contract, or steps you asked us to take (Art 6(1)(b)) |
We do not sell your data. We do not use it for advertising. We use no analytics or tracking tools.
5. Who receives data from Hven
| Organisation | Role | What it receives | Where it processes data |
|---|---|---|---|
| Railway | Hosts the whole service: the app, its database and its server logs | Everything Hven processes, including server logs that contain the email addresses of people we email, and the IP address of a refused sign-up | Railway's terms say it processes data primarily in the United States. We have not yet confirmed which Railway region Hven runs in. |
| Anthropic (Claude) | AI that answers check questions, and Hven's default AI for its own internal tasks (see below) | Check questions. For internal tasks: AI answers to grade, brand and competitor names, homepage text, and drafting tasks | United States; requests may be routed through the US, Europe, Asia and Australia |
| Google (Gemini) | AI that answers check questions | Check questions | Any country where Google has facilities |
| OpenAI | AI that answers check questions (Pro and Agency plans, and trials) | Check questions and the business's country | United States |
| Perplexity | AI that answers check questions (paid plans, and trials) | Check questions and the business's country | North America |
| xAI (Grok) | AI that answers check questions (Agency plan) | Check questions | Not tied to one region |
| Moonshot AI (Kimi) | AI that answers check questions (all plans, when we have it switched on) | Check questions | Singapore. Moonshot offers no data processing agreement and says it may use content to improve its models. |
| Resend | Sends Hven's emails | Your email address and the full email | United States |
| Google (Sign in with Google) | Sign-in, if you choose it | Google handles your sign-in; we receive your name and email | Google's own terms apply |
| Google (Places) | Finding businesses for Agency customers' pitch audits | The search words the customer types | Not stated by Google in our records |
| Google (Data Studio), only if you connect it | Shows your Hven reports in Data Studio | See section 12. While Data Studio is in early access, we also type the Google email address you gave us into Google's list of test users. | Google's own terms apply |
| Google Fonts and jsDelivr | Deliver fonts and a charting library to the app | Your IP address and browser details, when the app loads | Not confirmed |
| Cloudflare (Turnstile) | Checks that sign-ups and website scans come from people, when switched on | Your IP address and browser signals | Not stated by Cloudflare |
| Cloudinary | Stores logos you upload | Logos only | United States (Cloudinary's default) |
| Places you send data to yourself | Slack, your own webhooks, your WordPress site | What you set up: report scores and alerts, or files for your site | Wherever you choose |
Hven's internal AI tasks (grading answers, reading homepages, drafting text) go to the one AI company Hven is set up to use. Hven's default is Anthropic. We will add any other company to the table above before using it.
The questions we send to AI companies can include your business's name, your competitors' names, and your country or city. Your social media handles are not sent to any AI company.
Do the AI companies train on what we send?
- Anthropic, OpenAI, Perplexity and xAI state that they do not use API requests to train their models by default.
- Google's position depends on which Gemini service is used, and we have not yet confirmed it here.
- Moonshot says it may.
6. Data sent outside the UK
Most of the organisations above process data outside the UK, mainly in the United States.
- Anthropic, Railway and Cloudinary: their published data processing terms include the EU Standard Contractual Clauses with the UK Addendum.
- Google, OpenAI, xAI, Perplexity, Resend, Cloudflare and jsDelivr: we have not yet confirmed which transfer safeguard applies to each. Ask us and we will tell you what we know.
- Moonshot AI (Singapore): the UK has no adequacy decision for Singapore, and Moonshot offers no transfer clauses.
7. How long we keep data
This is what Hven does today.
| Data | How long we keep it |
|---|---|
| Sign-in codes, Data Studio sign-in codes and approval tickets | 10 to 30 minutes |
| Data Studio access keys | 1 hour after expiry plus 1 day; renewal keys until 90 days unused, plus 1 day |
| IP-address limits for the free tools | 2 days |
| Setup progress events | 90 days |
| App page-view records | 12 months |
| Free-tool results for visitors without an account | 30 days |
| Your account, workspace, businesses, check results, security log and email copies | Until the workspace is deleted |
| Data Studio connection records (who connected, when, and when it was disconnected) | Until the workspace is deleted, even after disconnecting |
| Data Studio early-access requests (the Google email address you gave us) | Until the workspace is deleted. Once Data Studio no longer needs requests, each address is deleted 90 days after its request last changed. |
| Free-tool emails and the IP address used | No end date yet |
| Homepage website scans (section 3.6) | No end date yet |
| Feedback you send | While your account exists; deleted when your account is deleted |
| Records of people we contacted (3.5) | No end date yet |
| Data-export files you download | The download link works for 7 days from when the file is ready; Hven then deletes the file |
When a workspace is deleted, most of its records are removed from our database, but not all (section 8).
8. Your rights
You have the right to:
- get a copy of your data;
- correct it;
- delete it;
- restrict how we use it;
- object to how we use it, including any use based on legitimate interests;
- move it to another service;
- withdraw consent where we rely on consent.
How to use your rights: email info@hven.io. A person reads and handles every request; nothing is automated. We will reply within one month.
What you can do yourself today, and what you can't:
- Copy of your data. Workspace admins can download an export in Settings, under Your data. The export does not yet include everything we hold. For example, it leaves out copies of emails, AI answers in full, and your preferences. Each export includes a list of what it contains and what it leaves out. Ask us for the rest.
- Corrections. You can change your name, workspace name (admins), password and email preferences in Settings. You cannot change your email address yourself; ask us.
- Deletion. You can delete a business you added. To delete your whole account or workspace, email us; there is no delete button yet. Deleting a workspace removes most of its records from our database, including uploaded logos, export files, feedback and the data-export keys you created. It does not yet remove some records about free-tool use, and some other records we keep a list of. It cannot recall data already sent to the organisations in section 5, which keep it under their own rules.
- Removing a team member switches their access off but keeps their details in the workspace; ask us if you want them deleted.
Complaints. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would like the chance to help first.
9. Automated decisions
We do not make decisions about you, using only automated means, that have legal effects on you or affect you in a similarly significant way.
To stop abuse, sign-up runs automatic checks that can refuse an account:
- a check that the visitor is a person, when switched on;
- refusing throwaway email addresses;
- refusing a form that was filled in impossibly fast, with a message that says so.
If you think one of these stopped you wrongly, email info@hven.io and a person will look.
10. Cookies and browser storage
Hven sets no cookies. Hven stores some things in your browser's own storage, listed below. Nothing in it is used for advertising or tracking.
| What | Why | Needed? |
|---|---|---|
Your sign-in session (lighthouse.auth.token) | Keeps you signed in | Essential |
A one-time sign-in check (hven.google.verifier) | Protects Google sign-in; cleared when the tab closes or sign-in finishes | Essential |
Staff tools: support tokens (_impersonation_*) and folded sections on staff pages (lighthouse.adminOps.*, lighthouse.adminAnalytics.*) | Only for Hven staff | Essential (staff only) |
| Theme, collapsed menu, chosen business, dismissed messages, the last time you looked at actions, "not now" choices on suggestions | Remembers choices you made | Preferences |
Setup progress (hven_onboarding_…) and a "shown once" flag for the founder's note (_fn_shown_…) | Remembers where you are in setup. The founder-note key name, and in some cases the setup key name, can contain your email address. | Preferences |
Feedback you sent (hven_feedback_submissions) | Keeps a copy of your feedback on your device | Not essential |
A sign-in count (lighthouse.onboarding) | Decides when to show tips | Not essential |
Free tool theme (hven_llms_theme) and homepage scan hand-over (hven.concierge.scan) | For visitors without an account | Preferences / essential |
Short-lived tab flags (_ob_login_counted, _hven_ob_migrated_…, signupCodeRedemptionOutcome, lighthouse.pitchDiscoveryUnavailable) | Stop the same thing happening twice; cleared when the tab closes | Essential |
Other services your browser contacts:
- Google Fonts, when the app or the Data Studio approval page loads, and jsDelivr, when the app loads. They see your IP address.
- Cloudflare Turnstile, on the sign-up page and the homepage scan when it is switched on, to check you are a person. Cloudflare's own script runs this check in your browser and sees your IP address and browser details; Cloudflare's privacy policy covers it.
- Cited websites: on the citations page, your browser loads each cited website's small icon from that website, which sees your IP address.
- Setup videos: if a setup page shows a video, it comes from the video service that hosts it (YouTube, Vimeo, Loom or Wistia). That service sees your IP address and may set its own cookies.
11. Children
Hven is for businesses. You must be 18 or over to use it. We do not ask for age at sign-up. If you think someone under 18 has given us their data, email info@hven.io and we will delete it.
12. The Data Studio connector
You can choose to see your Hven reports in Google Data Studio.
What it can do.
- A workspace admin connects it by clicking Open in Data Studio in Hven and approving the connection.
- Data Studio can then read your workspace's report data: brand names, weekly scores, rivals, citations, actions, and the country you set for each business in Hven. It cannot change anything in Hven.
What Google receives.
- Google's Data Studio and Apps Script receive this report data each time a report refreshes.
- They also hold the connection's Hven access keys.
- If the connector hits an error, Google records the error in Hven's Google Cloud project.
- When Hven opens Data Studio for you, the web address carries only the report template and the connector's public identifiers and, for a report about one client, that business's Hven id: a random code, not its name. No name, email or key is in it.
- Anyone you share the report with in Data Studio can see the data. Google's own terms and privacy policy cover what Google does with it.
What Hven receives from Google.
- Hven does not receive any data about your Google account through the connector: not your Google email address, name, or anything else from Google's services. If you ask for early access, you type your Google email address into Hven yourself. We use it only to add you to Google's list. Any email about your request goes to the address you use to sign in to Hven.
- The connector asks Google for one permission only: to connect to Hven's website.
- Hven records which Hven user connected, when, and when the connection was last used or disconnected. It stores the connection's access keys only in a scrambled form.
- If you add your own Google Analytics to a Data Studio report, you connect it directly with your own Google account. Hven never receives, stores or reads your Google Analytics data.
How to stop it. To disconnect, go to Integrations in Hven, then Data Studio reports, and click Disconnect. If a team member who connected Data Studio is removed, their connections stop working.
13. Changes to this notice
We will change the date at the top when we update this notice. For important changes we will email account holders before the change takes effect.
14. Contact and complaints
Email info@hven.io. We reply by email. To complain to the regulator, see section 8.